ClawHub
Back to skill

Security audit

Obsidian Official CLI Headless

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for headless Obsidian setup, but it performs root-level persistent system changes with weak guardrails around paths and permissions.

Install only on a machine where you are comfortable with persistent root-level changes. Use a fresh, dedicated vault path, avoid broad paths like /, /root, /home, or application directories, do not set WRAPPER_PATH unless you have audited it, and expect verification to write a marker into the vault.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to execute shell scripts as root and to install system packages, create users, modify ACLs, and place a wrapper in /usr/local/bin, yet it declares no permissions. This creates a misleading trust boundary: a caller or platform may treat the skill as low-privilege while it actually performs privileged host-level operations, increasing the risk of unauthorized system changes if invoked in the wrong context.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script grants the obsidian user recursive rwx ACLs on an arbitrary VAULT_PATH and also sets a default ACL so future files inherit that access. Because VAULT_PATH is user-controlled and the script runs as root, this can unintentionally expose or modify sensitive data outside the intended vault scope, especially if an operator points it at an existing system or application directory.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
WRAPPER_PATH is taken from the environment and later written by root with shell redirection, allowing overwrite of an arbitrary file path as root. If an attacker can influence the environment or invocation, they could replace a privileged executable, startup script, or other sensitive file and achieve persistence or privilege escalation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The verification script performs a real write operation by appending a marker to the user's daily note, modifying vault content as part of a check. Even though the marker is harmless and likely intended as a functionality test, it changes user data without explicit confirmation, dry-run mode, or cleanup, which can surprise users and pollute notes in production vaults.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.